Captcha challenge incorporating obfuscated characters

ABSTRACT

A method for determining if a user of a computer system is a human. A processor receives an indication that a computer security program is needed and acquires at least one image depicting a first string of characters including at least a first and second set of one or more characters. A processor assigns a substitute character to be used as input for each of the second set of one or more characters. A processor presents the at least one image and an indication of the substitute character and when to use the substitute character to the user. A processor receives a second string of characters from the user. A processor determines whether the second string of characters substantially matches the first string of characters based on the substitute character assigned to each of the second set of one or more characters and determines whether the user is a human.

BACKGROUND OF THE INVENTION

The present invention relates generally to the field of informationsecurity, and more particularly to a Completely Automated Public TuringTest to Tell Computers and Humans Apart (CAPTCHA) program forauthenticating an interaction occurring with a human and denying accessto another computer or a software robot.

A CAPTCHA is a program that protects Websites against automated programs(bots) by generating and grading tests that humans can pass, butcomputer programs either cannot pass or have difficulty passing. Onecommon implementation is a CAPTCHA comprised of one or more orderedstrings of characters, sometimes separated by a space, representedwithin one or more images. Within the one or more images, the charactersmay be manipulated using various methods to distort the appearance ofthe characters. Humans may be able to read, or otherwise recognize, suchdistorted characters, but a computer program may not. In such animplementation, a user's response is typically an ordered string ofcharacters that, when received, are tested for matches on a one-for-onebasis to the CAPTCHA characters.

A CAPTCHA is sometimes referred to as a reverse Turing test, as it isthe computer testing a human and not the other way around. A CAPTCHAoftentimes acts as a security mechanism by requiring a correct answer toa question, which, theoretically, only a human can answer better than arandom guess. CAPTCHA's are useful for several applications, including:preventing comment spam in blogs, protecting Website registration,protecting e-mail addresses from Web scrapers, preventing on-line pollsfrom being biased by responses from non-human sources, preventingdictionary attacks on password systems, and even preventing worms andspam in e-mail.

SUMMARY

Embodiments of the present invention disclose a method, computer programproduct, and system for determining if a user of a computer system is ahuman. A processor receives an indication that a computer securityprogram is needed. In response, a processor acquires at least one imagedepicting a first string of characters including at least a first set ofone or more characters and a second set of one or more characters. Theprocessor assigns a first substitute character to be used as input foreach of the second set of one or more characters, wherein the firstsubstitute character is a different character than any of the second setof one or more characters. The processor presents the at least oneimage, an indication of the first substitute character and an indicationof when to use the first substitute character to the user. The processorreceives a second string of characters from the user. The processordetermines whether the second string of characters substantiallymatches, within a predetermined threshold, the first string ofcharacters based on the first substitute character assigned to each ofthe second set of one or more characters. The processor determineswhether the user is a human.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts an illustrative diagram of a distributed data processingenvironment, in accordance with an embodiment of the present invention.

FIG. 2 is a flowchart depicting operational steps of a CAPTCHA program,in accordance with an embodiment of the present invention.

FIG. 3a depicts illustrative examples of potential CAPTCHA characters,in accordance with an embodiment of the present invention.

FIG. 3b is a table illustrating font types that generate symbols whichare mapped to alphanumeric characters, in accordance with an embodimentof the present invention.

FIG. 3c depicts an example of a CAPTCHA, in accordance with anembodiment of the present invention.

FIG. 4 is a block diagram of components of the servers and clientcomputer of FIG. 1, in accordance with one embodiment of the presentinvention.

DETAILED DESCRIPTION

Various embodiments, in accordance with the present invention, recognizethat recent advances in machine vision systems and optical characterrecognition (OCR) technologies have allowed computers to more frequentlydefeat less sophisticated character-based Completely Automated PublicTuring Test to Tell Computers and Humans Apart (CAPTCHA) schemes.Alteration techniques are oftentimes applied to character-based CAPTCHAsto deform or distort characters. Embodiments of the present inventionincorporate one or more obfuscated characters within a CAPTCHA challengeand present the user with an indication that one or more substitutecharacters are required to answer the CAPTCHA. The indication describingwhich substitute character(s) replace each of one or more obfuscatedcharacters in the user's response is a message presented separately orincluded in the CAPTCHA window. Similarly, advances in digital signalprocessing and voice recognition have allowed automated program to morefrequently defeat less sophisticated audio CAPTCHA schemes. Variousembodiments can also be applied to the creation and presentation ofaudio CAPTCHAs to combat automated programs using these advances inaudio technology. Other embodiments may improve the accuracy of theresponse of humans to a CAPTCHA challenge or present new approaches tocombat automated programs. In some embodiments, successful proof ofhumanity is based, at least in part, on successfully recognizingstandard CAPTCHA characters and correctly identifying the obfuscatedcharacters.

An embodiment employs rules to increase the degree of protection for asecured resource. Some rules can relate to the obfuscated charactersincorporated within the CAPTCHA challenge and to the messages presentedto the user describing which substitute character(s) are to beintegrated within the user's response. The obfuscated characters, forexample, can range in appearance from undistorted shapes, which appearto be comprised of multiple characters, to virtually shapeless blobs.The substitute character message can be, for example, a simpledeclaration such as, “Use ‘#’ for . . . ”. Examples of substitutecharacter messages which require analysis by the user are, an answer toa mathematical word problem, “use the value of two cubed for . . . ” or“use the symbol that makes numerical comparison true 10 “3=30 for . . .”. A further embodiment can incorporate multiple obfuscated characterswithin the CAPTCHA and one of the rules of the protected resource canemploy a particular way to describe the message. The user may have thesubstitute character message presented in a separate pop-up window as atable with a description of how to use the table of substitutecharacters to respond to the CAPTCHA. Some embodiments are configured toproduce both visual and audio CAPTCHAs. In such embodiments, the CAPTCHAchallenges can be visual, and the substitute character messages can beaudio clips. These methods, as well as rules governing the calculationsrelative to the CAPTCHA response accuracy, can be used singly or incombination to satisfy the security concerns associated with the securedresource.

Other embodiments of this invention allow the user to change thelanguage used to present the text or audio implementations of theCAPTCHA. Similarly, an embodiment of this invention may detect the typeof input device, as well as the language preference, to tailor CAPTCHAsto the character set available from the input device; for example, ifthe user has an APL programming keyboard, the user can access to alarger group of non-alphanumeric symbols to use as substitutecharacters. Whereas a user with a touchscreen device may have a reducedset of characters with which to respond. Some computing devices havevoice recognition capabilities, and a user may, in some cases, speak theresponse and have the spoken response converted to characters which cansubsequently be used to answer the CAPTCHA.

FIG. 1 depicts a diagram of distributed data processing environment 100,in accordance with embodiments of the present invention. In the depictedembodiment, data processing environment 100 includes server 104, server106, client computer 110, and data storage 108 interconnected overnetwork 102. Data processing environment 100 contains network 102, whichacts as a medium for providing communications links between variousdevices and computers connected together within the data processingenvironment. Network 102 may be a local area network (LAN), a wide areanetwork (WAN) such as the Internet, any combination thereof, or anycombination of connections and protocols that will supportcommunications between server 104, server 106, client computer 110, anddata storage 108, in accordance with embodiments of the invention.Network 102 may include connections, such as wired, wirelesscommunication links, or fiber optic cables. Data processing environment100 may include additional servers, client computers, displays, andother devices not shown.

Server 104 may be, for example, a server system such as a managementserver, a Web server, or any other electronic device or computing systemcapable of processing program instructions and receiving andtransmitting data. In another embodiment, server 104 may represent aserver system utilizing multiple computers as a server system, such asin a cloud computing environment. In certain embodiments, server 104 canrepresent a computer system utilizing clustered computers and componentsthat act as a single pool of seamless resources when accessed throughnetwork 102, as is common in certain data centers with cloud computingapplications. Server 104 may be a node in a distributed databasemanagement system. Server 104 includes an instance of CAPTCHA program114 and user interface (UI) 116. In general, server 104 can berepresentative of any computing device or a combination of devices withaccess to CAPTCHA program 114 and is capable of executing CAPTCHAprogram 114. Server 104 may include components, as depicted anddescribed in further detail with respect to FIG. 4.

Server 106 may be, for example, a server system such as a managementserver, a Web server, or any other electronic device or computing systemcapable of processing program instructions and receiving andtransmitting data. In another embodiment, server 106 may represent aserver system utilizing multiple computers as a server system, such asin a cloud computing environment. In some embodiments, server 106 hostsone or more secured resources which the user of client computer 110 canaccess after completing a CAPTCHA through CAPTCHA program 114. Server106 may also contain third-party databases and analytic software (notshown) to monitor the requests for access to the one or more securedresources. Server 106 may include internal and external hardwarecomponents, as depicted and described in further detail with respect toFIG. 4.

Client computer 110 may be, for example, a client computer system suchas a notebook, a laptop computer, a tablet computer, a handheld deviceor smart phone, a thin client, or any other electronic device orcomputing system capable of communicating with a server system, such asserver 104, server 106, and/or accessing data storage 108 throughnetwork 102. In one embodiment, client computer 110 acts as a client toserver 104. Client computer 110 may contain user interface (UI) 112 andclient application 120. Client computer 110 may include components, asdepicted and described in further detail with respect to FIG. 4.

Data storage 108 may be a repository that may be written and read byCAPTCHA program 114, client application 120, and/or a third-partyanalysis program. Data storage 108 comprises one or more of thefollowing: secured data resources, CAPTCHA libraries, secured resourcedatabase, or user ID database. Data storage 108 may reside on a serveror other computing device (not shown).

User interface (UI) 112 operates on client computer 110 to generatedisplay signals corresponding to content, such as windows, menus, andicons, and to receive various forms of user input. In one embodiment, UI112 comprises an interface to client application 120. UI 112 may displaydata received from client application 120. UI 112 may send input toclient application 120. UI 112 may comprise one or more interfaces, suchas an operating system interface and/or application interfaces. UI 112may process and display received and selected image information, as wellas accept data entry from a user. UI 112 may be, for example, agraphical user interface (GUI).

Client application 120 requests access to a secured resource via network102. In response to the request for access from client application 120,server 104 activates CAPTCHA program 114. CAPTCHA program 114 initiatesa CAPTCHA challenge, which is transmitted to client computer 110 anddisplayed within client application 120 via UI 112. The user inputs aresponse to the CAPTCHA via UI 112. Client application 120 transmits theuser's response to CAPTCHA program 114 and awaits CAPTCHA program 114analysis of the user's response to the CAPTCHA. In some embodiments, ifCAPTCHA program 114 identifies the user at client application 120 as ahuman, then CAPTCHA program 114 grants client application 120 access tothe secured resource. If the CAPTCHA program 114 is unsure of the user'snature, then another CAPTCHA challenge is transmitted to client computer110. If CAPTCHA program 114 decides that the user is not human, theCAPTCHA program 114 transmits a lock out indication to clientapplication 120.

UI 116 on server 104 generates display signals corresponding to content,such as windows, menus, and icons, and receives various forms of userinput. In one embodiment, UI 116 comprises an interface which allows asystem administrator to monitor which secured resources are accessed andthe frequency of the attempts to access secured resources. If a systemadministrator detects suspicious activity, then the system administratorcan update CAPTCHA program 114 security rules to increase the CAPTCHAchallenge difficulty, block access from specific user ID's or IPaddresses, or take a secured resource off line. In another embodiment, asystem administrator may, for example, create CAPTCHA rules for newsecured resources, do statistical analysis of CAPTCHA characters'failure rates, or modify a substitute character library which CAPTCHAprogram 114 accesses. In one embodiment, UI 116 displays data receivedfrom CAPTCHA program 114. UI 116 can also send received input to CAPTCHAprogram 114. UI 116 may comprise one or more interfaces, such as anoperating system interface and/or application interfaces. In someembodiments, UI 116 is a Web user interface (WUI). A WUI receives inputand transmits output (such as selected image information) by generatingWeb pages which are transmitted via the Internet (such as network 102)and viewed by the user (e.g., at client computer 110) using a Webbrowser program (not shown).

CAPTCHA program 114 secures a computer resource, such as a database(e.g., data storage 108), application, or some other program by onlyallowing access to the computer resource when CAPTCHA program 114determines that a user trying to access the secured resource is a human.CAPTCHA program 114 transmits the CAPTCHA image(s) to client computer110 and receives a response from the client computer. In someembodiments, CAPTCHA program 114 may transmit animated images and/oraudio messages to client computer 110, rather than one or more staticimages. CAPTCHA program 114 uses the received response to determinewhether or not to allow access to the secured resource.

In one embodiment, server 104 includes an instance of CAPTCHA program114. In such an embodiment, CAPTCHA program 114 may be a Web-basedprogram accessible to many client devices (e.g., client computer 110)attempting to access a secured resource via client application 120. Inone embodiment, the secured resource resides on server 104. In anotherembodiment, the secured resource resides on server 106. In such anembodiment, server 106 can act as a relay between CAPTCHA program 114and client computer 110 to determine if access to the secured resourceon server 106 is granted to client application 120. In yet anotherembodiment, CAPTCHA program 114 resides on server 104 and dynamicallycreates CAPTCHA challenges as needed based on the security rules of thesecured resource accessed.

In some embodiments, data gathered, generated, and/or maintained for useby CAPTCHA program 114 may be stored on server 104, data storage 108, oranother computer system (not shown). Examples of the data used byCAPTCHA program 114 may include, but are not limited to, a list ofsuspect IP addresses, CAPTCHA characters restricted from use, CAPTCHAcharacters designed to “trap” automated programs, user ID's and thefrequency of access attempts related to the ID's, and the name ofresources attempting to be accessed.

FIG. 2 depicts a flowchart of the steps of CAPTCHA program 114,executing within data processing environment 100 of FIG. 1, fordetermining if a user of a computer system is a human or an automatedprogram, in accordance with an illustrative embodiment of the presentinvention. In one embodiment, server 104 receives a request to access asecured resource and passes the access control to CAPTCHA program 114 toinitiate a CAPTCHA challenge. CAPTCHA program 114 analyzes the securityrules associated with the secured resource and, in one embodiment,acquires a CAPTCHA based on one or more security rules from an externalcomputing resource. In another embodiment, CAPTCHA program 114 generatesa CAPTCHA incorporating the one or more security rules. CAPTCHA program114 presents a CAPTCHA to a user, wherein the CAPTCHA includes one ormore images depicting characters (e.g., alphabetic letters, numericaldigits, punctuation marks, other graphemes, etc.), and at least onecharacter, which is deliberately presented in an unfamiliar appearance(e.g., unreadable, illegible, obfuscated, ambiguous, etc.). “Obfuscatedcharacters” is a non-inclusive, illustrative descriptor for characters,which are handled uniquely, based on the embodiments of the inventionimplemented. CAPTCHA program 114 integrates a message describing to theuser the one or more characters to substitute for existing characterspresented in an unfamiliar appearance in the presented CAPTCHA. CAPTCHAprogram 114 also compares received responses to the ordered descriptionassociated with the CAPTCHA using a variety of techniques and determineswhether the user attempting to access the resource is a human or acomputer.

In step 202, CAPTCHA program 114 receives a request for a CAPTCHAchallenge in response to a user requesting access to, but not limitedto, a resource. Information associated with the resource may require aCAPTCHA managed by CAPTCHA program 114 to determine whether the user isa human, a bot, or a computer program. In some embodiments, the requestmay further include rules indicating requirements for the CAPTCHA,threshold requirements for passing, or other information. In otherembodiments, the CAPTCHA program monitors if the request for access isan initial request or is a subsequent attempt. If the access request isa subsequent attempt, a rule can define such that the difficulty of theCAPTCHA challenge increases based on the number of access attempts of aCAPTCHA managed by CAPTCHA program 114, successful or unsuccessful, fromthe same IP address. CAPTCHA program 114 may use other methods todetermine if a higher difficulty challenge is required.

In step 204, CAPTCHA program 114 determines one or more rules for theCAPTCHA challenge. The one or more rules refer to, for example, a degreeof difficulty of a particular CAPTCHA that is presented to a user insolving the CAPTCHA challenge, the number of obfuscated characterswithin a particular CAPTCHA, a particular way to describe the substitutecharacter message to the user, a weight, or set of weights, to apply toone or more characters, types of characters (e.g., regular characters,obfuscated characters, etc.) and/or images within a particular CAPTCHAor a variety of other rules that may modify the level of security of theCAPTCHA. In one embodiment, CAPTCHA program 114 applies predeterminedsecurity requirements to a requested CAPTCHA based on the “importance”or “sensitivity” assigned to a secured resource. In another embodiment,the one or more rules are based on or linked to a specific securedresource. In a different embodiment, a rule is set to prioritize theaccuracy comparisons to identify an automated program over a human user.In some embodiments, if CAPTCHA program 114 detects suspicious activity,or is notified of suspicious activity, for example by a security program(not shown), then CAPTCHA program 114 can apply more stringent securityrules to acquire a more difficult challenge. An example of such activitymay be multiple users seeking access to the same resource at the sametime. In one embodiment, CAPTCHA program 114 determines the existence ofsuch suspicious activity if there are repeated attempts of a CAPTCHAmanaged by CAPTCHA program 114, successful or unsuccessful, from thesame IP address. CAPTCHA program 114 may use other methods to determineif a higher difficulty challenge is required.

In one embodiment, a rule prioritizes an accuracy comparison to identifyautomated programs over a human user. For example, an automated programcan have a high accuracy rating for one comparison test for a CAPTCHA,but the automated program may also accurately identify characters whicha human user can only guess at or respond to with a designatedsubstitute character. Such an example, an animated CAPTCHA, is flashedat a high rate rather than incorporating physical movement of thecharacters, and a pair of characters are overlapped. In this example,the pair of characters is ‘6’ and ‘9’. Alternately flashing thecharacters of the pair of characters at a high rate produces anappearance of a single distorted ‘8’ to a human user. An automatedprogram using OCR technology may identify the pair of characterscorrectly as ‘6’ and ‘9’. In such a case, the human may have a loweraccuracy for a direct match comparison. For example, if thepredetermined thresholds were a range, a human may not be expected toproduce a perfect response. Alternatively, in weighted comparisonidentifying the ‘6’ and ‘9’ at a specific position can result in areduced accuracy comparison for the automated program.

In some embodiments, CAPTCHA program 114 utilizes a CAPTCHA thatincludes two or more groups of obfuscated characters with differingcharacteristics. In such an embodiment, each group can have a descriptorassigned which describes the characteristics of that group. In such anembodiment, each group may be assigned a substitute character for use ina manner similar to the previous description. Group characteristics caninclude factors such as character color, font, similarity to othercharacters (e.g., a capital I and a lower-case L can appear to be verysimilar characters, depending on the font used to produce thecharacter), and/or other factors. Additional rules that affects changesto the substitute character message are the following, a rule associatedwith the one or more obfuscated characters presenting a plurality ofsubstitute characters to be used by the users, and a rule used to modifysecurity considerations governing the response to specific instances ofthe one or more obfuscated characters. In one embodiment, a substitutecharacter message can describe rules governing the selection ofsubstitute characters to be used in the CAPTCHA response.

In step 206, CAPTCHA program 114 acquires a CAPTCHA image. In someembodiments, rather than an image, CAPTCHA program 114 acquires multipleimages, an animation, and/or audio message. In some embodiments, CAPTCHAprogram 114 can acquire the CAPTCHA image according to one or more rulesassociated with the request. In some embodiments, CAPTCHA program 114may generate a CAPTCHA image. In such an embodiment, CAPTCHA program 114may generate a CAPTCHA image using a variety of techniques. For example,CAPTCHA program 114 may select a random string of characters, insert atleast one obfuscated character within the string of characters, andsplit the string into sub-strings based on the types of characters(e.g., regular CAPTCHA characters, obfuscated characters, etc.). CAPTCHAprogram 114 saves an ordered description of the characters comprisingthe strings and each character's location within the string. CAPTCHAprogram 114 may apply one or more alteration techniques to thesub-strings and without changing the order of the sub-strings convertsthe sub-strings into one or more images which are into a CAPTCHA. TheCAPTCHA is assigned a unique identifier associating the CAPTCHA with theupdated ordered description.

In other embodiments, CAPTCHA program 114 retrieves a CAPTCHA image, orCAPTCHA images, that include at least one obfuscated character from arepository containing a library of CAPTCHA images, such as storagedevice 108. Some embodiments of the invention allow for each of the oneor more obfuscated characters to be in different images, such as whenthe particular CAPTCHA is composed of multiple images.

In one embodiment, CAPTCHA program 114 can further differentiate betweentwo or more sets of one or more obfuscated characters by assigning adescriptor to, or otherwise annotating, each group of one or moreobfuscated characters. Descriptors associated with each set of one ormore obfuscated characters may be based, at least in part, oncharacteristics of each character of the set, such as whether thecharacters are “unreadable” or “ambiguous”. For example, a descriptorcan be assigned to a set of one or more characters indicating that eachcharacter in the set is “unreadable”, such that each character isdeliberately distorted beyond recognition or is an altered shape whichwas not based on a character.

Another descriptor can be assigned to a set of one or more characters,indicating that each character in the set is “ambiguous”, wherein eachcharacter appears as though it can be two or more optionally selectablecharacters. A descriptor indicating that a set of one or more charactersis ambiguous can, for example, be assigned to a character which isminimally distorted and appears as, but is not limited to, a characterpresented in an unknown font or language, a character which appears tobe a combination of one or more characters or symbols, or a legiblesymbol which the user cannot create without the use of a special font, aprogram, or “hot-key” combination.

In another embodiment, the descriptor assigned to a group of charactersmay have a common definition. Examples of common descriptors include,but are not limited to, odd numbers, fractions, blue text, mathematicalsymbols, vowels, or geometric shapes.

In another embodiment, a set of obfuscated characters may be tailored toact as “traps” to, preferentially, identify automated programs andsoftware bots. For example, a character using a dingbat font may berepresented within an image of a CAPTCHA. A dingbat font is a font thathas symbols and shapes in the positions designated for alphabetic ornumeric characters. In such an embodiment, an automatic program orsoftware bot can recognize the alphanumeric character corresponding tothe dingbat font representation in the image and may be trapped intoselecting a character not depicted in the substitute character messageof a CAPTCHA image. In a different embodiment, two numbers that overlapmay appear to the user as one number. For example, in a segmented fontthe number 1 butted up to a number 3 may appear as an ‘8’ or a ‘B’ to ahuman, but an automated program may identify it as two characters ‘1’and ‘3’.

The various embodiments of the invention can be adapted to function withan animated CAPTCHA. An animated CAPTCHA may operate similarly, from theperspective of the user, to a CAPTCHA image. An animated CAPTCHA mayinclude, for example, one or more moving characters, background images,or foreground images within the animation.

Alternate embodiments are compatible with an audio presentation of aCAPTCHA wherein, CAPTCHA program 114 identifies the one or moreobfuscated character and/or any substitute characters with a sound or anoise. As with the visual embodiments of the invention, an audio clipcorresponding to the obfuscated character can be assigned multiplesubstitute characters to increase degrees of complexity to impedeautomated programs using voice recognition software, signal processors,or other techniques. For example, a message may indicate that audioclips of a first sound, for example a dog barking, corresponds to afirst substitute character, whereas audio clips of a second sound, forexample a bell ringing in the same audio CAPTCHA, corresponds to asecond substitute character.

In step 208, CAPTCHA program 114 assigns a substitute character to oneor more obfuscated characters within the CAPTCHA. In an embodiment,CAPTCHA program 114 assigns a single substitute character to representthe one or more obfuscated characters for use in the user's suggestedresponse. The one or more obfuscated characters may be the same, may beunique, or a combination thereof, in accordance with an embodiment ofthe invention. In another embodiment, CAPTCHA program 114 assignsmultiple substitute characters to one or more obfuscated characters, orgroups of one or more obfuscated characters, in the user response. Insuch an embodiment, CAPTCHA program 114 assigns substitute characters toeach obfuscated character, or group of obfuscated characters, based on aparticular characteristic, or shared characteristic within the group.For example, a substitute character may be assigned to one or morecharacters based on font, color, degree of obfuscation, or otherfactors. In yet another embodiment, CAPTCHA program 114 employs anassociated rule (see step 204) governing the occurrence of one or moreobfuscated characters, wherein the substitute character is based on thelocation of the obfuscated character within the string of characters. Anexample of such a rule is to use the ‘?’ character for the firstoccurrence of the obfuscated characters and the ‘%’ character for anysubsequent occurrence of the obfuscated character. In another example,CAPTCHA program 114 presents the user with a substitute characterdefinition based on the position of the obfuscated characters within theCAPTCHA, from left to right, (e.g., first position=‘!’, secondposition=‘@’, fifth position=‘%’).

In step 210, CAPTCHA program 114 formulates a substitution messagespecifying how the user is to respond to the one or more obfuscatedcharacters, based on the assigned substitute character(s). Thesubstitution message may be represented by one or more indications. Oneembodiment of the invention formulates a different indicationidentifying the use of a single assigned substitute character. Anindication within one or more embodiments of the invention includes, butis not limited to, a visual representation of a substitute character, atext description of how to input a substitute character, a usage messagepresented within the CAPTCHA image, an audio clip message, or anon-modal pop-up window. In general terms, indications provide the userwith information most often in the form of a visual or an audio message.In some embodiments, the substitute character will be an alphanumericcharacter, punctuation mark, or other symbol accessible through the useof a keyboard. In other embodiments, the substitute character may beselectable within UI 112, such as a selectable button or other elementwithin the CAPTCHA window. For example, if the assigned substitutecharacter is ‘?’, a message may be presented with the CAPTCHA thatstates “Use ‘?’ for ambiguous or unclear characters”. The ‘?’ characteris a non-inclusive illustrative example of a substitute character. The‘?’ used within the specification can be represented by a plurality ofcharacters within the actual implementation of an embodiment of thisinvention. The assumption in this case is for the user to respond with a‘?’ for any occurrence of an obfuscated character. For users unfamiliarwith this type of response to a CAPTCHA challenge, embodiments of thisinvention can present an aid to allow the users to access a “Help”screen where explanations of the terms and descriptors can be found.Examples of aids to access a Help screen include an icon, identifiedhot-key (e.g., ‘F1’ is a commonly used Help key), or a button. In oneembodiment, a rule associated with the received request (see step 202)describes a particular way to obscure the meaning or presentation of thesubstitute character message or otherwise transmit and present thesubstitute character message to client computer 110. For example, if thesubstitute character is ‘?’, CAPTCHA program 114 may present the messageas “Use the keyboard combination ‘shift /’ for the obfuscatedcharacter(s)” or, alternatively, if the substitute character is ‘[’,CAPTCHA program 114 may present the message as “Use the un-shiftedsymbol associated with the key to the right of the ‘P’ key for theobfuscated character(s)”. CAPTCHA program 114 may further adjust andobscure presentation of the message, based on associated rules andassigned substitute characters, to create a message such as, “Use thesymbol associated with the third odd number on the keyboard”. In anotherembodiment, CAPTCHA program 114 produces a message identifying thesubstitute character based on answering a question or completing amathematical equation. For example, CAPTCHA program 114 may produce amessage stating “US currency symbol associated with paper money” thatyields a substitute character of ‘$’, or “Use the mathematical symbolwhich makes this equation true: 10 is (greater than (>) or less than (<)20” that yields a substitute character of ‘<’. In some embodiments,messages and ways by which to present messages are stored in arepository, such as data storage 108. In some embodiments, a variety ofpredefined messages are associated with substitute characters

Some embodiments of the invention can constrain the substitutecharacter(s) chosen to allow for the formulation of the substitutecharacter message such that the message structure can be translated intoan audio clip.

In step 212, CAPTCHA program 114 transmits the CAPTCHA challenge and thesubstitute character message to the user via UI 112 and clientapplication 120. In one embodiment, the substitute character messagedisplays within the CAPTCHA challenge window. In other embodiments, amessage identifying the substitute character can replace a visualrepresentation of the message with an audio clip, triggering thesubstitute message to play for the user via a different method (e.g.,button, icon). In some embodiments, an audio clip message for thesubstitute character may be presented to the user, such that theidentity of the substitute character is obscured within the audiomessage. For example, an audio message may describe the input character,provide a series of two or more keystrokes on a keyboard that willresult in the character being input, describe the location of thecharacter within a standard QWERTY keyboard, or may otherwise obscurethe message identifying the substitute character.

In some embodiments, CAPTCHA program 114 presents the substitutecharacter message to the user in a separate window, such as a pop-up ormodal window.

In step 214, CAPTCHA program 114 receives a user's response to theCAPTCHA challenge. In some embodiments, the user's response is anordered selection of characters, or string of characters, correspondingto the ordered plurality of characters and the one or more obfuscatedcharacters that make up the string of characters of the particularCAPTCHA challenge. In some embodiments, the user's response may be aselection of characters from a physical or virtual keyboard, such as aQWERTY keyboard. In other embodiments, the user's response may be aselection of images corresponding to the characters depicted within theCAPTCHA challenge.

In step 216, CAPTCHA program 114 evaluates the accuracy of the receivedresponse. In one embodiment, CAPTCHA program 114 compares the orderedselection of characters of the response to the ordered plurality ofcharacters and the one or more obfuscated characters of the CAPTCHA.CAPTCHA program 114 evaluates the accuracy of the response. In someembodiments, CAPTCHA program 114 evaluates the accuracy of the responseby analyzing the ordered selection of the characters of the response,the ordered plurality of characters, and the one or more obfuscatedcharacters in relation to a predetermined threshold for accuracy definedwithin a rule associated with the received request for the CAPTCHAchallenge (see step 204). In some embodiments, a rule associated withthe received request (see step 204) may cause CAPTCHA program 114 toallow for some inaccuracies in the user's response. In otherembodiments, a rule associated with the received request (see step 204)may cause CAPTCHA program 114 to allow minimal deviation from theexpected answer. Various predetermined thresholds can be passed toCAPTCHA program 114 to be used as references for, but not limited to, anaccuracy comparison or a weighting factor calculation.

In an embodiment, CAPTCHA program 114 employs weighting factors whichcan be applied to some or all of the characters within a CAPTCHA imageto analyze the accuracy of a user's response. In some embodiments,CAPTCHA program 114 applies weighting factors to different sets ofcharacters, such as sets of one or more characters with a singleassigned descriptor. In some embodiments, CAPTCHA program 114 adjustsweighting factors based on, for example, security concerns for thelocation or other resource a user is attempting to access. An example ofweighting factors are, for example, a weighting factor of 1 for eachcorrectly identified character of the first set, a weighting factor of0.5 for each correctly identified obfuscated character, and a weightingfactor of −2 for each incorrect character used for a substitutecharacter. In such an embodiment, a threshold may be specified by thereceived request, and CAPTCHA program 114 may apply the appropriateweighting, as specified by the received request, and compare theresulting number to the specified threshold to determine whether thereceived response passes or fails the particular CAPTCHA challenge.

In some embodiments, CAPTCHA program 114 reviews the rules determined atstep 204, and in response to the review, prioritizes the results fromthe one or more accuracy comparisons analyzed in relation to thepredetermined thresholds.

In another embodiment, CAPTCHA program 114 allows for non-standardcharacters, such as characters not usually located on a standard user'skeyboard or characters not of the user's default language preference, asspecified, for example, by the Web browser of the user accessing theCAPTCHA. Such characters or symbols can be difficult for an average userto reproduce and can act as a “trap” to detect that the user is anautomated program or a “bot”. In such an embodiment, CAPTCHA program 114may use such a trap to determine that a user correctly selecting such acharacter is likely an automated program. In some embodiments, CAPTCHAprogram 114 may be programmed to lock out a user more quickly if theycorrectly select such a character. For example, CAPTCHA program 114 maydetermine that a CAPTCHA response containing a match to one non-standardcharacter fails the requirements to pass the CAPTCHA challenge; however,CAPTCHA program 114 may also determine that a CAPTCHA responsecontaining matches to more than one non-standard character will triggeran immediate lock out. CAPTCHA program 114 can enforce such a lock outby banning, for example, the IP address of the user from access attemptsfor a period of time.

In decision 220, CAPTCHA program 114 determines whether the userattempting to access the location or resource has passed the rulerequirements of the CAPTCHA challenge, based on the evaluation of theaccuracy of the received response to the CAPTCHA challenge, and rulesassociated with the CAPTCHA challenge request (see step 204). If CAPTCHAprogram 114 determines the user has passed the CAPTCHA challenge (yesbranch, decision 220), the user is identified as human and CAPTCHAprogram 114 stores results of the CAPTCHA challenge (step 224).

In step 224, CAPTCHA program 114 stores one or more results of theCAPTCHA challenge for analysis. The one or more results may be stored onserver 104, data storage 108, or any other computing or storage resourceaccessible by network 102. The one or more results include, but are notlimited to, the CAPTCHA challenge presented to the user, the substitutecharacter message, the obfuscated characters, the response from the userand corresponding expected response, identification information of theuser, the user's IP address, and/or the identity of the resource orlocation accessed.

In step 226, CAPTCHA program 114 determines that the user is a humanand, in the depicted embodiment, grants the user access to the securedresource.

If CAPTCHA program 114 determines that the CAPTCHA challengerequirements were not met (no branch, decision 220), CAPTCHA program 114stores the one or more results of the CAPTCHA challenge for analysis(step 230). The one or more results may be stored on server 104, server106, data storage 108, or any other computing or storage resourceaccessible by network 102. The one or more results include, but are notlimited to, the CAPTCHA challenge presented to the user, the substitutecharacter message, the obfuscated characters, the response from the userand corresponding expected response, identification information of theuser, the user's IP address, and/or the identity of the resource orlocation the user is attempting to access. In some embodiments, imageswhich are misidentified by a majority of users can be prevented from usein future CAPTCHAs. In other embodiments, subsequent analysis of datastored during step 224 and step 230 indicates that an image isconsistently misidentified by a majority of users, for example 90+% ofusers determined to be human misidentify the image as ‘P’. CAPTCHAprogram 114 modifies the image's identification to ‘P’ in futureCAPTCHAs.

In decision 234, CAPTCHA program 114 determines whether the user islocked out from additional attempts to access the location or resource.In some embodiments, CAPTCHA program 114 determines whether the user islocked out based on, at least in part, security rules associated withthe received request (see step 204). For example, the user may haveexceeded the number of CAPTCHA failures defined by a security ruleprotecting the resource. In another example, the user's response may beindicative of an automated program rather than a human, such as in thepreviously described trap. If CAPTCHA program 114 determines that theuser is locked out from additional attempts to access the location orresource (yes branch, decision 234), CAPTCHA program 114 initiates alock out of the user (step 236). In some embodiments, CAPTCHA program114 can lock out the user by preventing access to the location orresource, and documenting the requesting IP address, in order to preventthe documented IP address from making further attempts over a period oftime, or indefinitely, based on a security level or rule associated withthe location or resource.

If CAPTCHA program 114 determines that the user is not locked out (nobranch, decision 234), then CAPTCHA program 114 allows the user toattempt another CAPTCHA challenge (step 204). Examples of criteria whichallow a subsequent CAPTCHA attempt are, the user has not yet exceededthe number of CAPTCHA challenge failures as defined by a security ruleprotecting the resource or CAPTCHA program 114 cannot determine that theuser is an automated program in response to analyzing the one or moreprioritized accuracy comparisons.

In one embodiment, CAPTCHA program 114 reviews the stored data (see step230) to determine if subsequent CAPTCHA challenges presented to the userhave modified rules applied (step 204). Modified rules may include, forexample, rules instructing CAPTCHA program 114 to incorporate moreobfuscated characters within the CAPTCHA, acquire a more difficultCAPTCHA, or change one or more predetermined thresholds.

FIGS. 3a and 3b depict illustrative examples of unaltered characters,which may be associated with different descriptors, in accordance withone embodiment of the invention. FIG. 3c depicts an example of CAPTCHAchallenge 320, as created by CAPTCHA program 114 and presented to theuser, in accordance with at least one embodiment of the currentinvention.

FIG. 3a depicts a non-inclusive set of example characters which may beassigned, for example, the descriptor of “ambiguous”. In this example,“ambiguous characters” can be characters which appear as though they mayeach be two or more optionally selectable characters. In someembodiments, a plurality of characters may be assigned the descriptor of“ambiguous”, for example, expanding the character library to otherlanguages or acquiring characters or symbols which were specificallycreated by combining one or more characters. The characters arerepresentative of symbols or characters which are not readily recreatedon a standard keyboard without the use of a program, re-mapping akeyboard, or hot-key combination.

FIG. 3b depicts table 310. Table 310 depicts a non-inclusive array ofcharacters from three different fonts. Row 311 includes a group ofEnglish language alphabetical characters as depicted by a common font.Row 312 and row 313 are each fonts of symbols and shapes in place of thealphabetic and other characters of the common font. Column 314 a is anexample of the English letter ‘a’ in the common font and represented bythe equivalent character Alt Font #1 (see row 312) and Alt Font #2 (seerow 313), respectively. Column 314 b is an example of the English letter‘g’ in the common font and represented by an equivalent in Alt Font #1(see row 312) but Alt Font #2 (see row 313) does not contain a characterequivalent to “g”. The characters represented by Alt Font #1 and AltFont #2, if incorporated into a CAPTCHA challenge for example, may beassigned the descriptor of “non-standard” in a substitute charactermessage. In one embodiment, if the CAPTCHA image contained the Alt Font#1 and Alt Font #2 equivalents of the common font “a”, a human'sresponse may be the substitute character or a guess; whereas, anautomated program may identify occurrences of the Alt Font #1 and AltFont #2 equivalents of ‘a’ as ‘a’ and be “trapped” into exposing itselfas an automated program.

FIG. 3c , CAPTCHA challenge 320, depicts an example of the output ofCAPTCHA program 114 as presented to a user, in accordance with at leastone embodiment of the current invention.

Image 321 is an illustrative example of a CAPTCHA challenge imagecreated by CAPTCHA program 114, in accordance with one or moreembodiments of this invention and is comprised of two distorted groupsof images (image 321 a, image 321 b) separated by a gap (space/blankcharacter). Image 321 a is comprised of six characters, four standardcharacters and two obfuscated characters, assigned the descriptor“ambiguous”. “Ambiguous” characters, in this example, appear ascharacters which are a combination of one or more characters or symbols.The second character of image 321 a appears to be a combination of ‘p’and ‘b’ whereas the sixth character appears to be a combination of ‘o’and ‘n’. Image 321 b is comprised of four characters, three standardcharacters and one deliberately illegible character, which is assignedthe descriptor ‘unreadable”. The fourth character, for example, is“unreadable” because the width of the strokes creating the character arewide enough to eliminate any white space.

Button 324 may be selected by the user to activate an audio clippresentation of the characters within the CAPTCHA challenge image 321.Alphanumeric can be spoken within the audio clip while another sound maybe presented for “ambiguous” character and a different sound presentedas the “unreadable” character. For example, the audio clip associationfor “ambiguous” characters may be animal sounds and for “unreadable”characters the associated audio clip may be a monotone sound. An exampleof a CAPTCHA audio clip of such an embodiment is “capital-d ‘lion'sroar’ small-q capital-V capital-T ‘cat's meow’” followed by a pause toindicate a space then “one nine three ‘B-flat tone’”.

Substitute character message 325 is an illustrative depiction of asubstitute character message formulated by CAPTCHA program 114, inaccordance with an embodiment of the current invention. The substitutecharacter message indicates, that in this embodiment, there are twotypes of obfuscated characters. The types of obfuscated characters areidentified by character descriptors 326, in accordance with anembodiment of the current invention. One descriptor is “ambiguous”, andthe other descriptor is “unreadable”. Substitute character message 325defines for the user the character or keyboard combination necessary tocreate the character used to input each “ambiguous” or “unreadable”character. In the depicted example the substitute character(s) are shownas reverse tone text.

Button 327 is an example of a button selected by the user to activatethe audio clip presentation of substitute character message 325. Whenbutton 327 is selected, the audio clip will read the substitutecharacter message and substitute words or descriptions to aid thecomprehension of the substitute character message. For example, ‘=’ ispresented as “the equals key”, ‘Shift 7’ can be presented as “hold theshift key down while pressing the number seven along the top of thekeyboard”. This is an important distinction, using the ‘7’ key on thenumeric keypad creates a different result. The audio clip may be asingle spoken description or it may be presented in a manner to allowthe user to play/replay the audio clip for each substitute character orcharacter descriptor separately.

Button 329 is an example of a “Help” button which the user may select toobtain more information for the depicted CAPTCHA challenge. Oneembodiment of this invention will provide further information about theimplementation of the CAPTCHA challenge and the nature of the substitutecharacter. Another embodiment will provide explanations of each of thecharacter descriptors presented in the substitute character message. Forexample, selecting the button 329 opens a message defining “unreadable”characters as a character which is deliberately distorted beyondrecognition or is an altered shape which was not based on a characterand an “ambiguous” character can be defined as a character which appearsas though it may be two or more optionally selectable characters.

User response area 322 includes a message and an input area. User'sresponse 323 is “D=qVT=193&” and is the expected answer to the depictedCAPTCHA challenge image 321.

FIG. 4 depicts a block diagram of components of server 104, server 106,and client computer 110, in accordance with an illustrative embodimentof the present invention. It should be appreciated that FIG. 4 providesonly an illustration of one implementation and does not imply anylimitations with regard to the environments in which differentembodiments may be implemented. Many modifications to the depictedenvironment may be made.

Server 104, server 106, and client computer 110 each includecommunications fabric 402, which provides communications betweencomputer processor(s) 404, memory 406, persistent storage 408,communications unit 410, and input/output (I/O) interface(s) 412.Communications fabric 402 can be implemented with any architecturedesigned for passing data and/or control information between processors(such as microprocessors, communications and network processors, etc.),system memory, peripheral devices, and any other hardware componentswithin a system. For example, communications fabric 402 can beimplemented with one or more buses.

Memory 406 and persistent storage 408 are computer readable storagemedia. In this embodiment, memory 406 includes random access memory(RAM) 414 and cache memory 416. In general, memory 406 can include anysuitable volatile or non-volatile computer readable storage media.

CAPTCHA program 114, user interface 116, user interface 112, and clientprogram 120 are stored in respective persistent storage 408 forexecution and/or access by one or more of the respective computerprocessor(s) 404 via one or more memories of memory 406. In thisembodiment, persistent storage 408 includes a magnetic hard disk drive.Alternatively, or in addition to a magnetic hard disk drive, persistentstorage 408 can include a solid state hard drive, a semiconductorstorage device, read-only memory (ROM), erasable programmable read-onlymemory (EPROM), flash memory, or any other computer readable storagemedia that is capable of storing program instructions or digitalinformation.

The media used by persistent storage 408 may also be removable. Forexample, a removable hard drive may be used for persistent storage 408.Other examples include optical and magnetic disks, thumb drives, andsmart cards that are inserted into a drive for transfer onto anothercomputer readable storage medium that is also part of persistent storage408.

Communications unit 410, in these examples, provides for communicationswith other data processing systems or devices, including server 104,server 106, client computer 110, and data storage 108. In theseexamples, communications unit 410 includes one or more network interfacecards. Communications unit 410 may provide communications through theuse of either or both physical and wireless communications links.CAPTCHA program 114 and user interface 116, client application 120, anduser interface 112 may be downloaded to respective persistent storage408 through communications unit 410.

I/O interface(s) 412 allows for input and output of data with otherdevices that may be connected to server 104, server 106, and clientcomputer 110, or data storage 108. For example, I/O interface(s) 412 mayprovide a connection to external device(s) 418 such as a keyboard, akeypad, a touch screen, and/or some other suitable input device.External device(s) 418 can also include portable computer readablestorage media such as, for example, thumb drives, portable optical ormagnetic disks, and memory cards. Software and data used to practiceembodiments of the present invention, e.g., CAPTCHA program 114, userinterface 116, client application 120, user interface 112, and can bestored on such portable computer readable storage media and can beloaded onto persistent storage 408 via I/O interface(s) 412. I/Ointerface(s) 412 also connect to a display 420.

Display 420 provides a mechanism to display data to a user and may be,for example, a computer monitor.

The programs described herein are identified based upon the applicationfor which they are implemented in a specific embodiment of theinvention. However, it should be appreciated that any particular programnomenclature herein is used merely for convenience, and thus theinvention should not be limited to use solely in any specificapplication identified and/or implied by such nomenclature.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computer,or entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, a special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The descriptions of the various embodiments of the present invention arepresented for purposes of illustration but are not intended to beexhaustive or limited to the embodiments disclosed. Many modificationsand variations will be apparent to those of ordinary skill in the artwithout departing from the scope and spirit of the invention. Theterminology used herein was chosen to best explain the principles of theembodiment, the practical application or technical improvement overtechnologies found in the marketplace, or to enable others of ordinaryskill in the art to understand the embodiments disclosed herein.

The programs described herein are identified based upon the applicationfor which they are implemented in a specific embodiment of theinvention. However, it should be appreciated that any particular programnomenclature herein is used merely for convenience, and thus theinvention should not be limited to use solely in any specificapplication identified and/or implied by such nomenclature.

The invention claimed is:
 1. A computer program product for determiningif a user of a computer system is a human, the computer program productcomprising: one or more computer readable storage media and programinstructions stored on the one or more computer readable storage media,the program instructions comprising: program instructions to receive anindication that a computer security program is needed, and in response,acquiring, by one or more processors, at least one image depicting afirst string of characters including at least a first set of one or morecharacters, and a second set of one or more characters; wherein eachcharacter of the first set of one or more characters is an alphanumericcharacter; and wherein each character of the second set of one or morecharacters is illegible; program instructions to assign a firstsubstitute character to be used as input for each of the second set ofone or more characters, wherein the first substitute character is adifferent character than any of the second set of one or morecharacters; program instructions to present the at least one image, anindication of the first substitute character, and an indication of whento use the first substitute character to the user, wherein presentingthe at least one image, an indication of the first substitute character,and an indication of when to use the first substitute character to theuser comprises: program instructions to present the at least one image,a description of the first substitute character, and an indication ofwhen to use the first substitute character to the user; and programinstructions to receive a second string of characters from the user;program instructions to determine whether the second string ofcharacters substantially matches, within a predetermined threshold, thefirst string of characters based on the first substitute characterassigned to each of the second set of one or more characters, whereinthe determination further comprises: program instructions to compareeach character of the second string of characters to a respectivecharacter within the first string of characters, according to characterlocations within each string of characters; and program instructions toassociate a weighting factor to each character of the second string ofcharacters based on the comparison and the set of one or more characterswithin which the respective character of the first string of charactersis a member; and program instructions to determine that the secondstring of characters substantially matches, within a secondpredetermined threshold, the first string of characters, based on theweighting factor associated with each character within the second stringof characters; and responsive to determining that the second string ofcharacters substantially matches, within a second predeterminedthreshold, the first string of characters, based on the weighting factorassociated with each character within the second string of characters,program instructions to determine that the user of the computer systemis a human.